[java-oidc-common] branch main updated: JCOMOIDC-94 - Profile configuration option for refresh token type
Henri Mikkonen
henri.mikkonen at iki.fi
Wed Jan 3 13:47:17 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=05c795c89c26f768b60ea3b8cd402d994311e4d7
The following commit(s) were added to refs/heads/main by this push:
new 05c795c JCOMOIDC-94 - Profile configuration option for refresh token type
05c795c is described below
commit 05c795c89c26f768b60ea3b8cd402d994311e4d7
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Jan 3 15:45:54 2024 +0200
JCOMOIDC-94 - Profile configuration option for refresh token type
https://shibboleth.atlassian.net/browse/JCOMOIDC-94
"refreshTokenType" option added to OAuth2RefreshTokenProducingProfileConfiguration and AbstractOIDCSSOConfiguration.
Default value (null) refers to the opaque format.
---
.../navigate/RefreshTokenTypeLookupFunction.java | 53 ++++++++++++++++++++++
...2RefreshTokenProducingProfileConfiguration.java | 13 ++++++
.../config/impl/AbstractOIDCSSOConfiguration.java | 34 +++++++++++++-
3 files changed, 99 insertions(+), 1 deletion(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenTypeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenTypeLookupFunction.java
new file mode 100644
index 0000000..af1d034
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenTypeLookupFunction.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2RefreshTokenProducingProfileConfiguration;
+
+
+/**
+ * A function that returns
+ * {@link OAuth2RefreshTokenProducingProfileConfiguration#getRefreshTokenType(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ *
+ * @since 3.1.0
+ */
+public class RefreshTokenTypeLookupFunction extends AbstractRelyingPartyLookupFunction<String> {
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public String apply(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OAuth2RefreshTokenProducingProfileConfiguration) {
+ return ((OAuth2RefreshTokenProducingProfileConfiguration) pc).getRefreshTokenType(input);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java
index d1cbdf2..f98b766 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java
@@ -22,6 +22,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.shared.annotation.ConfigurationSetting;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.Positive;
/**
@@ -58,6 +59,18 @@ public interface OAuth2RefreshTokenProducingProfileConfiguration extends OAuth2P
@Nonnull @Positive Duration getRefreshTokenChainLifetime(
@Nullable final ProfileRequestContext profileRequestContext);
+ /**
+ * Get refresh token type.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return refresh token type, or null for unspecified/opaque
+ *
+ * @since 3.1.0
+ */
+ @ConfigurationSetting(name="refreshTokenType")
+ @Nullable @NotEmpty String getRefreshTokenType(@Nullable final ProfileRequestContext profileRequestContext);
+
//TODO: can move the getRefreshTokenClaimsSetManipulationStrategy from the OAuth2TokenProfileConfiguration in 3.0.0
// to keep consistent with other token producers
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
index 4b3797b..3e61d08 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
@@ -66,7 +66,10 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
/** Lookup function to supply access token type. */
@Nonnull private Function<ProfileRequestContext,String> accessTokenTypeLookupStrategy;
-
+
+ /** Lookup function to supply refresh token type. */
+ @Nonnull private Function<ProfileRequestContext,String> refreshTokenTypeLookupStrategy;
+
/** Lookup function to supply access token lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> accessTokenLifetimeLookupStrategy;
@@ -111,6 +114,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
refreshTokenTimeoutLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
refreshTokenChainLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
+ refreshTokenTypeLookupStrategy = FunctionSupport.constant(null);
assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(null);
@@ -414,6 +418,34 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
/** {@inheritDoc} */
@Override
+ @Nullable @NotEmpty public String getRefreshTokenType(@Nullable final ProfileRequestContext profileRequestContext) {
+ return refreshTokenTypeLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set refresh token type.
+ *
+ * @param type token type, or null for unspecified/opaque
+ *
+ * @since 3.1.0
+ */
+ public void setRefreshTokenType(@Nullable @NotEmpty final String type) {
+ refreshTokenTypeLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(type));
+ }
+
+ /**
+ * Set lookup strategy for token token type.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 3.1.0
+ */
+ public void setRefreshTokenTypeLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ refreshTokenTypeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
@Nonnull @NonnullElements @NotLive public Set<String> getAdditionalAudiencesForIdToken(
@Nullable final ProfileRequestContext profileRequestContext) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list